A set of smart vending machines at the University of Waterloo has stirred up quite the controversy among students, who quickly raised privacy concerns after discovering the machines' facial recognition application. 

The machines, which are located in the school's Modern Languages building and Hagey Hall, feature M&M displays and sell treats such as chocolate and candy. 

One eagle-eyed student recently noticed an error message from the machine, which noted an issue with its facial recognition application. A photo of the message was shared on Reddit, resulting in a flood of reactions from students who expressed concerns about privacy and similar software. 

"Pre-law students where you at, let's get a class-action going already," one student wrote. "Wait this is so f*cked how are people okay with this," another comment reads. 

hey so why do the stupid m&m machines have facial recognition?
byu/SquidKid47 inuwaterloo

Many students suggested covering the machine's hole — where many suspected there to be a security camera— with gum or tape. 

"We wouldn't have known if it weren't for the application error. There's no warning there," said River Stanley, a fourth-year student who analyzed the vending machines for an article in mathNEWS, a university publication. 

"What students have been doing over the past two weeks is coming up with sticky tack, with chewing gum, with post-it notes, doing anything to cover these sensors," Stanley explained.

The company that provides the machines, Adaria Vending Services Limited, told CTV News that they are a "fulfillment service provider" and do not own or manufacture the machines, noting that they do not have access to their data either. 

new vending machines have always-on facial recognition cameras - top left pinhole, under the blue m&m
byu/dreadfuldreadnought inuwaterloo

The machines' manufacturer, Invenda, told mathNEWS that the smart vending machines and its associated detection software operates entirely locally. 

"It does not engage in storage, communication, or transmission of any imagery or personally identifiable information. The software conducts local processing of digital image maps derived from the USB optical sensor in real-time, without storing such data on permanent memory mediums or transmitting it over the Internet to the Cloud," Invenda's founder said in a statement. 

Despite this, many students continue to be uncomfortable with the machines' presence on campus.

"Although the processing may be performed locally, people have a right to know that biometric data is being used. At a minimum there should have been a sign posted on or close by the machine," one person wrote on Reddit. 

Several comments also referenced a description of the vending machines, which reads, "The facial recognition camera and video display signage on the front of the vending machine can collect data about the customer’s age and gender. Once the data has been sent to the control unit, the data can be combined with other information, such as local weather conditions and time of day." 

As a result, the University of Waterloo has asked for the machines to be removed from campus "as soon as possible," and asked that the software be disabled, according to university spokesperson Rebecca Elming who spoke with CTV News. 

"Students can ask that University administration bar facial recognition vending machines from campus. Adaria's Invenda machines can secretly read students' biometric data without our consent. With no consent, the M&M's machines' facial recognition follows in the footsteps of historical open violations of Canadian privacy law," Stanley said. 

He also noted that if the machines are not removed, he is prepared to file a complaint to the Information and Privacy Commissioner of Ontario.